Re: [PATCH v6 06/31] ext4: fix orig_mlen initialization in ext4_map_blocks()

[Ojaswin Mujoo]

On Thu, Sep 03, 2026 at 08:35:18PM +0800, Zhang Yi wrote:
> From: Zhang Yi <yi.zhang@xxxxxxxxxx>
> 
> Save orig_mlen after clamping map->m_len to INT_MAX. Otherwise, the
> unclamped value may be passed below, bypassing its overflow protection.
> 
> Fixes: 5bb12b1837c0 ("ext4: Add support for EXT4_GET_BLOCKS_QUERY_LEAF_BLOCKS")
> Signed-off-by: Zhang Yi <yi.zhang@xxxxxxxxxx>

Thanks for fixing this, feel free to add:

Reviewed-by: Ojaswin Mujoo <ojaswin@xxxxxxxxxxxxx>

Regards,
ojaswin
> ---
>  fs/ext4/inode.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
> index b71b1d2588ae..73af6d386985 100644
> --- a/fs/ext4/inode.c
> +++ b/fs/ext4/inode.c
> @@ -703,7 +703,7 @@ int ext4_map_blocks(handle_t *handle, struct inode *inode,
>  	struct extent_status es;
>  	int retval;
>  	int ret = 0;
> -	unsigned int orig_mlen = map->m_len;
> +	unsigned int orig_mlen;
>  #ifdef ES_AGGRESSIVE_TEST
>  	struct ext4_map_blocks orig_map;
>  
> @@ -719,6 +719,7 @@ int ext4_map_blocks(handle_t *handle, struct inode *inode,
>  	 */
>  	if (unlikely(map->m_len > INT_MAX))
>  		map->m_len = INT_MAX;
> +	orig_mlen = map->m_len;
>  
>  	/* We can handle the block number less than EXT_MAX_BLOCKS */
>  	if (unlikely(map->m_lblk >= EXT_MAX_BLOCKS))
> -- 
> 2.52.0
>